FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

lib: handle --permission-audit when propagating flags · nodejs/node@c7d27c8 · GitHub

/ node Public

Commit c7d27c8

Browse files
RafaelGSS
authored and
aduh95
committed
lib: handle --permission-audit when propagating flags
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: #63047 Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent 20c553e commit c7d27c8

4 files changed

Lines changed: 109 additions & 3 deletions

File tree

‎lib/child_process.js‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -549,7 +549,8 @@ function getPermissionModelFlagsToCopy() {
549549

550550
function copyPermissionModelFlagsToEnv(env, key, args) {
551551
// Do not override if permission was already passed to file
552-
if (args.includes('--permission') || (env[key] && env[key].indexOf('--permission') !== -1)) {
552+
if (args.includes('--permission') || args.includes('--permission-audit') ||
553+
(env[key] && env[key].indexOf('--permission') !== -1)) {
553554
return;
554555
}
555556

‎lib/ffi.js‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,11 @@ DynamicLibrary.prototype[SymbolDispose] = function() {
6161
};
6262

6363
function checkFFIPermission() {
64-
if (!permission.isEnabled() || permission.has('ffi')) {
64+
if (!permission.isEnabled()) {
65+
return;
66+
}
67+
68+
if (permission.has('ffi') || permission.isAuditMode()) {
6569
return;
6670
}
6771

‎lib/internal/process/permission.js‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,17 +11,25 @@ const { Buffer } = require('buffer');
1111
const { isBuffer } = Buffer;
1212

1313
let _permission;
14+
let _audit;
1415
let _ffi;
1516

1617
module.exports = ObjectFreeze({
1718
__proto__: null,
1819
isEnabled() {
1920
if (_permission === undefined) {
2021
const { getOptionValue } = require('internal/options');
21-
_permission = getOptionValue('--permission');
22+
_permission = getOptionValue('--permission') || getOptionValue('--permission-audit');
2223
}
2324
return _permission;
2425
},
26+
isAuditMode() {
27+
if (_audit === undefined) {
28+
const { getOptionValue } = require('internal/options');
29+
_audit = getOptionValue('--permission-audit');
30+
}
31+
return _audit;
32+
},
2533
has(scope, reference) {
2634
validateString(scope, 'scope');
2735
if (reference != null) {

‎test/parallel/test-permission-audit-child-process-inherit-flags.js‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
// Flags: --permission-audit --allow-child-process --allow-fs-read=* --allow-fs-write=*
2+
'use strict';
3+
4+
const common = require('../common');
5+
const { isMainThread } = require('worker_threads');
6+
7+
if (!isMainThread) {
8+
common.skip('This test only works on a main thread');
9+
}
10+
if (process.config.variables.node_without_node_options) {
11+
common.skip('missing NODE_OPTIONS support');
12+
}
13+
14+
const assert = require('assert');
15+
const childProcess = require('child_process');
16+
17+
// Verify that the parent is running in audit mode
18+
assert.strictEqual(typeof process.permission.has, 'function');
19+
20+
{
21+
assert.strictEqual(process.env.NODE_OPTIONS, undefined);
22+
}
23+
24+
// Child should inherit --permission-audit and the allow-flags via NODE_OPTIONS
25+
{
26+
const { status, stdout } = childProcess.spawnSync(process.execPath,
27+
[
28+
'-e',
29+
`
30+
console.log(typeof process.permission);
31+
console.log(process.permission.has("fs.write"));
32+
console.log(process.permission.has("fs.read"));
33+
console.log(process.permission.has("child"));
34+
`,
35+
]
36+
);
37+
assert.strictEqual(status, 0);
38+
const [permType, fsWrite, fsRead, child] = stdout.toString().split('\n');
39+
assert.strictEqual(permType, 'object');
40+
assert.strictEqual(fsWrite, 'true');
41+
assert.strictEqual(fsRead, 'true');
42+
assert.strictEqual(child, 'true');
43+
}
44+
45+
// Child spawned with explicit --permission should use its own flags, not inherit parent's
46+
{
47+
const { status, stdout } = childProcess.spawnSync(
48+
process.execPath,
49+
[
50+
'--permission',
51+
'--allow-fs-write=*',
52+
'-e',
53+
`
54+
console.log(typeof process.permission);
55+
console.log(process.permission.has("fs.write"));
56+
console.log(process.permission.has("fs.read"));
57+
console.log(process.permission.has("child"));
58+
`,
59+
]
60+
);
61+
assert.strictEqual(status, 0);
62+
const [permType, fsWrite, fsRead, child] = stdout.toString().split('\n');
63+
assert.strictEqual(permType, 'object');
64+
assert.strictEqual(fsWrite, 'true');
65+
assert.strictEqual(fsRead, 'false');
66+
assert.strictEqual(child, 'false');
67+
}
68+
69+
// Child spawned with explicit --permission-audit should use its own flags
70+
{
71+
const { status, stdout } = childProcess.spawnSync(
72+
process.execPath,
73+
[
74+
'--permission-audit',
75+
'--allow-fs-write=*',
76+
'-e',
77+
`
78+
console.log(typeof process.permission);
79+
console.log(process.permission.has("fs.write"));
80+
console.log(process.permission.has("fs.read"));
81+
`,
82+
]
83+
);
84+
assert.strictEqual(status, 0);
85+
const [permType, fsWrite, fsRead] = stdout.toString().split('\n');
86+
assert.strictEqual(permType, 'object');
87+
assert.strictEqual(fsWrite, 'true');
88+
assert.strictEqual(fsRead, 'false');
89+
}
90+
91+
{
92+
assert.strictEqual(process.env.NODE_OPTIONS, undefined);
93+
}

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL